fix: audit fixes — treatment sync, avatar upload, code consistency

- Always sync treatment end (not just early stop), pass start/end times
- treatment-done uses api.syncTreatment instead of raw http.post
- Move getApp() from module level to onLoad in treatment-done
- Avatar upload only returns URL, no longer updates profile directly
- COS CDN domain configurable via COS_CDN_DOMAIN env var
- Fix operator precedence in request.js token expiry check
- Remove unused result variable from COS putObject

server/src/routes/user.js

@@ -41,7 +41,7 @@ router.post('/user/avatar', requireUser, upload.single('file'), wrap(async (req,
   const ext = (req.file.originalname || '').split('.').pop() || 'jpg'
   const key = 'avatars/' + req.user.user_id + '_' + Date.now() + '.' + ext
   const cos = new COS({ SecretId: config.cos.secretId, SecretKey: config.cos.secretKey })
-  const result = await new Promise((resolve, reject) => {
+  await new Promise((resolve, reject) => {
     cos.putObject({
       Bucket: config.cos.bucket,
       Region: config.cos.region,
@@ -50,8 +50,7 @@ router.post('/user/avatar', requireUser, upload.single('file'), wrap(async (req,
       ContentType: req.file.mimetype
     }, (err, data) => err ? reject(err) : resolve(data))
   })
-  const avatarUrl = 'https://tx.vsai.net.cn/' + key
-  await userDao.updateProfile(req.user.user_id, { nickname: null, avatar: avatarUrl, gender: null })
+  const avatarUrl = 'https://' + (config.cos.cdnDomain || 'tx.vsai.net.cn') + '/' + key
   res.json(ok({ avatar: avatarUrl }))
 }))